$23.75M Oracle Key Exploit Rocks Perpetuals DEX Ostium

Ostium, a perpetuals decentralized exchange (DEX), lost $23.75 million in USDC after an attacker exploited a compromised oracle signer private key.

The attack occurred on July 15, 2026, when the attacker used a registered PriceUpKeep forwarder to submit future-dated, authorized oracle reports that tricked the protocol into thinking profitable trades existed.

The attacker then ran roughly 20 looped open-and-close trades through delegated actions, pulling repeated payouts from Ostium's main OLP (liquidity provider) vault without taking on real market exposure.

Ostium paused trading within an hour of the first malicious transaction and resumed trading on July 23 after an eight-day investigation and hardening effort.